# Latest **URL:** https://discuss.elastic.co/latest.md?page=1712 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1713 --- ## [How to include the ctx.payload.value in the email text for watcher alert?](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 23\ **Last updated:** [April 26, 2021, 4:07pm UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655 "2021-04-26T16:07:21Z")
Hello All, I am trying to create a watcher alert for the servers that communicated to elastic in last 48 hrs but not in last 35 mins. I want to include the ctx.payload.value result in my email text but all I am getting … --- ## [Decode\_xml not working](https://discuss.elastic.co/t/decode-xml-not-working/269763)
**Author:** [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Replies:** 5\ **Last updated:** [April 26, 2021, 4:04pm UTC](https://discuss.elastic.co/t/decode-xml-not-working/269763 "2021-04-26T16:04:38Z")
Hello, I'm using winlogbeats version 7.12 and it works great but I have a question. In my windows log in message field I have an XML. What I would like to do is first check if in that XML in specific field there is a s… --- ## [Filebeat decode\_xml processor missing](https://discuss.elastic.co/t/filebeat-decode-xml-processor-missing/268915)
**Author:** [@Francisco\_Peralta\_Gu](https://discuss.elastic.co/u/Francisco_Peralta_Gu)\ **Replies:** 5\ **Last updated:** [April 26, 2021, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-decode-xml-processor-missing/268915 "2021-04-26T16:03:43Z")
Hi. I'm facing issues trying to configure decode\_xml processor in filebeat version 7.11. The error is the following: Failed to start crawler: starting input failed: Error while initializing input: the processor ac… --- ## [Winlogbeat If statements](https://discuss.elastic.co/t/winlogbeat-if-statements/271275)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 3:18pm UTC](https://discuss.elastic.co/t/winlogbeat-if-statements/271275 "2021-04-26T15:18:51Z")
I am trying to do some conditional filtering of windows logon events and I am having some difficulty trying to figure out how the if statements work. How I am trying to get things to work is if it is a network logon do … --- ## [Hide elasticsearch superuser name and password in logstash conf](https://discuss.elastic.co/t/hide-elasticsearch-superuser-name-and-password-in-logstash-conf/271124)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 3:17pm UTC](https://discuss.elastic.co/t/hide-elasticsearch-superuser-name-and-password-in-logstash-conf/271124 "2021-04-26T15:17:11Z")
Hello all, The logstash (7.x) in the environment resides on the same server as filebeat. I am reluctant to mention superuser name and password info for elasticsearch in logstash.conf. Can I create a new user in Kibana … --- ## [Ingest with condition issue](https://discuss.elastic.co/t/ingest-with-condition-issue/271175)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 3:13pm UTC](https://discuss.elastic.co/t/ingest-with-condition-issue/271175 "2021-04-26T15:13:47Z")
met strange issue. created one ingest with condition by Kibana, and tested pass with my data in ingest edit by 'Add documents'. but failed when I use 'Dev Tools' in kibana, 'PUT' same data. why? will be failed, paste t… --- ## [CSV exported losing timezone setting](https://discuss.elastic.co/t/csv-exported-losing-timezone-setting/271004)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 8\ **Last updated:** [April 26, 2021, 3:12pm UTC](https://discuss.elastic.co/t/csv-exported-losing-timezone-setting/271004 "2021-04-26T15:12:11Z")
Hi all, Our kibana 7.12 started to show this behaviour (we are using Elastic Cloud). The dashboards show the timestamp formatted correctly as the Advanced Settings were chosen to be America/Sao\_Paulo. So the dashboard… --- ## [Is it possible to change the font color of the X and Y axis values on a Lens Bar Chart?](https://discuss.elastic.co/t/is-it-possible-to-change-the-font-color-of-the-x-and-y-axis-values-on-a-lens-bar-chart/271196)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 3:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-the-font-color-of-the-x-and-y-axis-values-on-a-lens-bar-chart/271196 "2021-04-26T15:10:06Z")
Hi Team, I'm using a Lens bar chart on one of my Canvas projects to bypass some of the existing printing to PDF issues w/ 7.9.2 where the X axis gets cut off, and I need to find a way to change the font color / size of … --- ## [Need to disable all the steps snaps in Elastic Synthetic](https://discuss.elastic.co/t/need-to-disable-all-the-steps-snaps-in-elastic-synthetic/269916)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 9\ **Last updated:** [April 26, 2021, 2:58pm UTC](https://discuss.elastic.co/t/need-to-disable-all-the-steps-snaps-in-elastic-synthetic/269916 "2021-04-26T14:58:22Z")
Hi Team, Are there any properties that allow us to capture images only when any errors happen in the configured flows? As of now, we can see more than 1 TB of Data utilized within 1 month and only with 2-3 flows. I am … --- ## [Cases feature in Kibana](https://discuss.elastic.co/t/cases-feature-in-kibana/271075)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:41pm UTC](https://discuss.elastic.co/t/cases-feature-in-kibana/271075 "2021-04-26T14:41:26Z")
Hi, I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this th… --- ## [Difference between results of two queries](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991)
**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 2:40pm UTC](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991 "2021-04-26T14:40:26Z")
Hi! I'm stuck and I really need help. Here is my use case: I would like to perform two queries and get as final result the difference between those two queries based on a specific field. Let's assume that I have these … --- ## [Search API doesnt match "33" for "033" in document title](https://discuss.elastic.co/t/search-api-doesnt-match-33-for-033-in-document-title/270090)
**Author:** [@Richard\_Forgacs](https://discuss.elastic.co/u/Richard_Forgacs)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:27pm UTC](https://discuss.elastic.co/t/search-api-doesnt-match-33-for-033-in-document-title/270090 "2021-04-26T14:27:48Z")
Hello! I couldn't figure it out how I can match the title e.g.: "Test title No.033" with query "33". When I search for "033", it return the document. But for only "33" it doesnt return :frowning: The guide is not very… --- ## [APM agent is not starting](https://discuss.elastic.co/t/apm-agent-is-not-starting/271228)
**Author:** [@ggio](https://discuss.elastic.co/u/ggio)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 2:25pm UTC](https://discuss.elastic.co/t/apm-agent-is-not-starting/271228 "2021-04-26T14:25:26Z")
Hi, I'm trying to integrate Elastic APM with some Java microservices running on Docker environment. These microservices are all defined inside a docker-compose YAML files Since the application is based on Java, I downl… --- ## [Calculate time difference in scripted field](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 18\ **Last updated:** [April 26, 2021, 2:22pm UTC](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213 "2021-04-26T14:22:57Z")
The question is how to get the difference from following date format in a second? For example, if date1 = 4/21/2021 7:53:50 and date2 = 6/21/2021 7:54:10, the answer should 20 . I am trying below code but it is providi… --- ## [Vegalite graph scale according to Min,Max of the value](https://discuss.elastic.co/t/vegalite-graph-scale-according-to-min-max-of-the-value/271246)
**Author:** [@usman1](https://discuss.elastic.co/u/usman1)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:00pm UTC](https://discuss.elastic.co/t/vegalite-graph-scale-according-to-min-max-of-the-value/271246 "2021-04-26T14:00:53Z")
I have plotted a graph using Vegalite visualization in Kibana as shown below: As it can be seen, Y-axis scale starts from 0 and goes upto 450. Though it covers the Maximum and Min values of Y variable but not efficie… --- ## [Multiple indexnames from 1 filebeat instance with ilm](https://discuss.elastic.co/t/multiple-indexnames-from-1-filebeat-instance-with-ilm/270762)
**Author:** [@Marcel\_van\_Zoggel](https://discuss.elastic.co/u/Marcel_van_Zoggel)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 1:57pm UTC](https://discuss.elastic.co/t/multiple-indexnames-from-1-filebeat-instance-with-ilm/270762 "2021-04-26T13:57:09Z")
I want to use filebeat on a server with 2 different logfolders. Each folder must go to a different indexname. This i can set via a custom field per input (fe. Field log\_type) in combination with output.elasticsearch.ind… --- ## [Logstash healthcheck](https://discuss.elastic.co/t/logstash-healthcheck/271088)
**Author:** [@sulsulatoff](https://discuss.elastic.co/u/sulsulatoff)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 1:43pm UTC](https://discuss.elastic.co/t/logstash-healthcheck/271088 "2021-04-26T13:43:42Z")
Our Logstash runs in a pod every 30 mins. Once in a while, it stops working and we need to restart the pod. Is there a way logstash can notify an external server that it's up and running (an http endpoint) --- ## [Relocation in loop on Elasticsearch 7.7](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486 "2021-04-26T13:25:18Z")
We recently upgraded from ES 5.4 to ES 7.7 and are facing this weird issue in production where relocation goes in a loop. Have noticed majorly on large clusters and having hot/cold config. e.g. following is cluster confi… --- ## [Query to calculate login success and failure rates](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787)
**Author:** [@Venkatesh\_Sridharan](https://discuss.elastic.co/u/Venkatesh_Sridharan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 12:45pm UTC](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787 "2021-04-26T12:45:21Z")
Hello All, I have a list of login events on the index which has the following fields. ip\_address: \ login\_success: \ Now I want to query the logs and get a count of number of success and failed logins from e… --- ## [Csv with date column](https://discuss.elastic.co/t/csv-with-date-column/271255)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 12:37pm UTC](https://discuss.elastic.co/t/csv-with-date-column/271255 "2021-04-26T12:37:34Z")
hi all, i have below blocks of csv data....date comes in first line followed by csv data ...i need to bring date with csv data as a column to process it with timestamp. 20210409 0030 Counter node-3 … --- ## [Customized Uptime dashboard , need to remove the TLS certificate field and modify the other field name](https://discuss.elastic.co/t/customized-uptime-dashboard-need-to-remove-the-tls-certificate-field-and-modify-the-other-field-name/271254)
**Author:** [@priya\_singh](https://discuss.elastic.co/u/priya_singh)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 12:31pm UTC](https://discuss.elastic.co/t/customized-uptime-dashboard-need-to-remove-the-tls-certificate-field-and-modify-the-other-field-name/271254 "2021-04-26T12:31:16Z")
Hi Teams , I have to customizwd the uptime dashboard as per client requiremnet . need to rename the Monitor to Backend System Url to Url Encode as well nned to made this feild value disabled Remove the TLS Certifica… --- ## [Many ttl:-2 states in registry file cause registry file big and makes the performance of filebeat unstable](https://discuss.elastic.co/t/many-ttl-2-states-in-registry-file-cause-registry-file-big-and-makes-the-performance-of-filebeat-unstable/271253)
**Author:** [@hukaixuan](https://discuss.elastic.co/u/hukaixuan)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 12:16pm UTC](https://discuss.elastic.co/t/many-ttl-2-states-in-registry-file-cause-registry-file-big-and-makes-the-performance-of-filebeat-unstable/271253 "2021-04-26T12:16:53Z")
how filebeat with k8s autodiscover configuration deal with ttl:-2 states entries when doing cleanup? our registry file got really big and lots of ttl:-2 state in it, seems like they didn't got cleaned thanks a lot f… --- ## [Elasticsearch snapshot struck in inprogress state](https://discuss.elastic.co/t/elasticsearch-snapshot-struck-in-inprogress-state/271240)
**Author:** [@722826c085cfc824006d](https://discuss.elastic.co/u/722826c085cfc824006d)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-struck-in-inprogress-state/271240 "2021-04-26T11:01:55Z")
we are using opensource elasticsearch version 5.6.10. In one of my ES cluster, the elasticsearch snapshot was struck in inprogress state from few days. I tried below options, but it didn't work out. ElasticSearch Versi… --- ## [Making cURL PUT, POST and DELETE requests?](https://discuss.elastic.co/t/making-curl-put-post-and-delete-requests/271235)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 10:46am UTC](https://discuss.elastic.co/t/making-curl-put-post-and-delete-requests/271235 "2021-04-26T10:46:44Z")
Sometimes Kibana times out when making certain large requests so I think I am forced to do it thru CLI. Issue is that I do not know how to currently make the sintaxis. I already generated a api key. For the sake of a e… --- ## [Adding additional weight without matching](https://discuss.elastic.co/t/adding-additional-weight-without-matching/270865)
**Author:** [@Silas\_Hansen](https://discuss.elastic.co/u/Silas_Hansen)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 10:07am UTC](https://discuss.elastic.co/t/adding-additional-weight-without-matching/270865 "2021-04-26T10:07:14Z")
I want to be able to Match a subset of the index with a query\_string query. Add additional weight to documents that match a set of post-evaluated criterias. Example: Let's say I have these two documents: \[ { … --- ## [Shard allocation awareness implementation in elasticsarch](https://discuss.elastic.co/t/shard-allocation-awareness-implementation-in-elasticsarch/271193)
**Author:** [@722826c085cfc824006d](https://discuss.elastic.co/u/722826c085cfc824006d)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 9:55am UTC](https://discuss.elastic.co/t/shard-allocation-awareness-implementation-in-elasticsarch/271193 "2021-04-26T09:55:25Z")
we are using open source elasticsearch 5.6.10 from last 2 years in AWS cloud, but didn't implement shard allocation awareness in the clusters. Since the lack of shard allocation of awareness, the shards are distributed i… --- ## [Metricbeat attempting to fetch metrics for unlisted metricset - why?](https://discuss.elastic.co/t/metricbeat-attempting-to-fetch-metrics-for-unlisted-metricset-why/271066)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 9:38am UTC](https://discuss.elastic.co/t/metricbeat-attempting-to-fetch-metrics-for-unlisted-metricset-why/271066 "2021-04-26T09:38:10Z")
I've installed metricbeat (7.12.0) and enabled the elasticsearch-xpack module. And configured it like so: - module: elasticsearch xpack.enabled: true period: 10s scope: cluster hosts: \["my-internal-elb.us-east… --- ## [Make two indexes which different fields communicate](https://discuss.elastic.co/t/make-two-indexes-which-different-fields-communicate/271137)
**Author:** [@dumpnetflow](https://discuss.elastic.co/u/dumpnetflow)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 9:07am UTC](https://discuss.elastic.co/t/make-two-indexes-which-different-fields-communicate/271137 "2021-04-26T09:07:23Z")
Hi Everyone, I have two indexes which are automatically generated by an application which I cannot modify. Index one has two fields: { "mappings": { "properties": { "src.ip.address": { "type": "ip" }, "dst.ip.ad… --- ## [Logging DELETE query in logs](https://discuss.elastic.co/t/logging-delete-query-in-logs/271229)
**Author:** [@Kunal\_Salvi](https://discuss.elastic.co/u/Kunal_Salvi)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 8:07am UTC](https://discuss.elastic.co/t/logging-delete-query-in-logs/271229 "2021-04-26T08:07:40Z")
Hello Elasticsearch team, Is there any place where Elasticsearch logs DELETE query action. Is any feature in BASIC license where I can trace the DELETE action happing on Elasticsearch? I understand the audit events can … --- ## [Using kibana7.10 with elasticsearch7.12 and beats 7.12](https://discuss.elastic.co/t/using-kibana7-10-with-elasticsearch7-12-and-beats-7-12/271176)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 7:50am UTC](https://discuss.elastic.co/t/using-kibana7-10-with-elasticsearch7-12-and-beats-7-12/271176 "2021-04-26T07:50:37Z")
hii Can i use kibana7.10 with elasticsearch 7.12 and beats7.12? thanx [Previous page](https://discuss.elastic.co/latest.md?page=1711) [Next page](https://discuss.elastic.co/latest.md?page=1713)